Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    12/05/2024, 09:23

General

  • Target

    39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe

  • Size

    2.6MB

  • MD5

    39628f6572e6bf8683a71f66014933a5

  • SHA1

    b4641f32159cb0de61e077566e027707b8429569

  • SHA256

    046fa33ef56688e34c5aa9dbaf8b673cbec5fbc2712196674403dfafd9f700ef

  • SHA512

    56c30c2f86d7b08aae9bd96e93e7305a2c26b90749fd7110315ff86370a2dd0f3352be1b2b1e715d6cbdb6d9364016dacdbcf9b1d18b7c5ce523d2dfa3b34e70

  • SSDEEP

    24576:I4KxV8f6044+c12Ny3tMDI0l+GjMZijmcpjjjjQnOjWLghlKh6w34kcCSC9Bzv85:6E9euqNScU+vPtSRotkDWef/Dbyp

Malware Config

Extracted

Family

orcus

C2

192.168.1.135:2410

Mutex

7fa2f818413f42a2990b40d91a249534

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    true

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Signatures

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

  • Orcurs Rat Executable 5 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1072
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
        PID:1988
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        2⤵
          PID:852
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          2⤵
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:1968

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1072-0-0x00000000742CE000-0x00000000742CF000-memory.dmp

        Filesize

        4KB

      • memory/1072-1-0x0000000000B30000-0x0000000000DC8000-memory.dmp

        Filesize

        2.6MB

      • memory/1072-2-0x00000000742C0000-0x00000000749AE000-memory.dmp

        Filesize

        6.9MB

      • memory/1072-3-0x0000000005F20000-0x000000000601A000-memory.dmp

        Filesize

        1000KB

      • memory/1072-4-0x00000000004C0000-0x00000000004D4000-memory.dmp

        Filesize

        80KB

      • memory/1072-24-0x00000000742C0000-0x00000000749AE000-memory.dmp

        Filesize

        6.9MB

      • memory/1072-23-0x00000000742CE000-0x00000000742CF000-memory.dmp

        Filesize

        4KB

      • memory/1968-10-0x0000000000400000-0x00000000004E8000-memory.dmp

        Filesize

        928KB

      • memory/1968-13-0x0000000000400000-0x00000000004E8000-memory.dmp

        Filesize

        928KB

      • memory/1968-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

      • memory/1968-17-0x0000000000400000-0x00000000004E8000-memory.dmp

        Filesize

        928KB

      • memory/1968-9-0x0000000000400000-0x00000000004E8000-memory.dmp

        Filesize

        928KB

      • memory/1968-8-0x0000000000400000-0x00000000004E8000-memory.dmp

        Filesize

        928KB

      • memory/1968-18-0x0000000000500000-0x000000000050E000-memory.dmp

        Filesize

        56KB

      • memory/1968-19-0x0000000000E80000-0x0000000000EDC000-memory.dmp

        Filesize

        368KB

      • memory/1968-20-0x0000000000850000-0x0000000000862000-memory.dmp

        Filesize

        72KB

      • memory/1968-21-0x0000000000A30000-0x0000000000A48000-memory.dmp

        Filesize

        96KB

      • memory/1968-22-0x0000000000EF0000-0x0000000000F00000-memory.dmp

        Filesize

        64KB

      • memory/1968-15-0x0000000000400000-0x00000000004E8000-memory.dmp

        Filesize

        928KB

      • memory/1968-7-0x0000000000400000-0x00000000004E8000-memory.dmp

        Filesize

        928KB